CVE-2026-119133 Details
Description
Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent host fields in embedders with exceptions enabled, although no exploitation path is currently known.
A memory misalignment vulnerability has been identified in Wasmtime versions 47.0.0 prior to 48.0.6 and 49.0.0 prior to 49.0.3. This vulnerability arises from an odd number of exception tags in WebAssembly modules, leading to undefined behavior by misaligning host fields in embedders with exceptions enabled. While no known exploitation path currently exists, this misalignment can cause serious issues as Rust compiler and LLVM revisions are released.
Users can update to Wasmtime versions 48.0.6 or 49.0.3, where this vulnerability has been patched. Alternatively, exception support can be disabled in the command-line interface or through the Wasmtime API.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-758 | Reliance on Undefined, Unspecified, or Implementation-Defined Behavior | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance Wasmtime | >= 47.0.0, < 48.0.6 (semver) >= 49.0.0, < 49.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |